Bump actions/download-artifact from 4 to 5

[dependabot]

Bumps actions/download-artifact from 4 to 5.

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

• Update README.md by @​nebuk89 in actions/download-artifact#407
• BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @​GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

• By name: name: my-artifact → extracted to path/ (direct)
• By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

• By name: name: my-artifact → extracted to path/ (unchanged)
• By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

• You download artifacts by name
• You download multiple artifacts by ID
• You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table> 

... (truncated)

Commits

• 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
• b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
• e262cbe bundle dist
• bff23f9 update docs
• fff8c14 fix download path logic when downloading a single artifact by id
• 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
• 47225c4 Update README.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[matter-code-review]

Summary By MatterAI

🔄 What Changed

This Pull Request updates the version of the actions/download-artifact GitHub Action used in the .github/workflows/release.yml workflow file. Specifically, it bumps the action from version v4 to v5. This is a minor, yet important, dependency update within the CI/CD pipeline configuration. 🚀

🔍 Impact of the Change

The primary impact of this change is to leverage the latest improvements, bug fixes, and potential security enhancements provided by version 5 of the download-artifact action. This ensures the build artifact download process in the release workflow is more robust, efficient, and secure. While the immediate functional change is minimal, it contributes to the overall health and maintainability of the CI/CD infrastructure. ✨

📁 Total Files Changed

• .github/workflows/release.yml: Updated the version of actions/download-artifact from v4 to v5.

🧪 Test Added

No explicit new tests were added as part of this configuration change. The functionality relies on the stability and backward compatibility of the updated GitHub Action itself.

🔒 Security Vulnerabilities

No new security vulnerabilities were introduced. On the contrary, updating to a newer version of a GitHub Action typically includes security patches and improvements, thereby enhancing the overall security posture of the CI/CD pipeline. ✅

Tip

Quality Recommendations

1. Consider implementing Dependabot or a similar dependency management tool for GitHub Actions to automate future version updates and receive alerts for new versions or security vulnerabilities.

2. Review the release notes for actions/download-artifact@v5 to understand any breaking changes or new features that could be leveraged or require adjustments in the workflow.

Tanka Poem ♫

Workflow's swift update,
Artifacts now flow anew,
Version five takes hold,
Builds secure, with purpose true,
Code's journey, ever fresh. 🧪

[matter-code-review]

Important

PR Review Skipped

PR review skipped as per the configuration setting. Run a manually review by commenting /matter review

💡Tips to use Matter AI

Command List

• /matter summary: Generate AI Summary for the PR
• /matter review: Generate AI Reviews for the latest commit in the PR
• /matter review-full: Generate AI Reviews for the complete PR
• /matter release-notes: Generate AI release-notes for the PR
• /matter : Chat with your PR with Matter AI Agent
• /matter remember : Generate AI memories for the PR
• /matter explain: Get an explanation of the PR
• /matter help: Show the list of available commands and documentation
• Need help? Join our Discord server: https://discord.gg/fJU5DvanU3